The NIST 800-171 ↔ CMMC Map
(and the 33 Frameworks Behind It)

Crosswalk content usually exists because someone is staring at two frameworks and a blank spreadsheet. This page gives you the maps. It also explains the Revision 2 versus Revision 3 situation that's currently confusing half the defense industrial base, and then makes a case you won't find in the typical crosswalk PDF: that the entire genre is compensating for evidence being trapped in one framework at a time.

CMMC Level 2 ↔ NIST 800-171: a 1:1 map

CMMC Level 2 doesn't modify, extend, or reinterpret NIST SP 800-171 Rev 2 — it is 800-171 Rev 2, all 110 requirements across 14 families, with 320 assessment objectives drawn from NIST SP 800-171A. What CMMC adds is the accountability machinery: SPRS scoring, the C3PAO certification assessment, conditional-status rules, and annual affirmations. If your 800-171 self-assessment is honest, you already know your CMMC Level 2 posture. (Level 1 maps to the 17 basic safeguarding practices of FAR 52.204-21; Level 3 layers a subset of NIST SP 800-172's enhanced requirements on top of Level 2.)

CSF 2.0 alignments shown at the family level are directional — individual requirements within a family frequently map to multiple functions and categories. That granularity is exactly where spreadsheet crosswalks start to break down, which we'll get to.

The Rev 2 / Rev 3 wrinkle (read this before you rebuild anything)

NIST published SP 800-171 Revision 3 in May 2024, and within NIST's own publication chain it supersedes Rev 2. This has caused predictable confusion — because for CMMC purposes, Rev 3 is not the standard. The CMMC rule pins Level 2 to Rev 2, SPRS scoring runs against Rev 2, and C3PAO assessments examine Rev 2 evidence. The DoD will transition through future rulemaking, on a timeline expected to run years, not months.

What changes when it eventually does: Rev 3 restructures to 97 requirements across 17 families, adding three new families — Planning (PL), System & Services Acquisition (SA), and Supply Chain Risk Management (SR) — and introduces 88 Organization-Defined Parameters that let agencies set specific values. Fewer requirements, but broader scope and more parameterization; it's a reorganization, not a relaxation.

The problem with crosswalks

Here's the uncomfortable truth about the genre this page belongs to: crosswalk spreadsheets exist because evidence gets trapped. You implement a control once — say, MFA with session timeout — and it satisfies 800-171 3.5.3, maps into CMMC IA, lands in CSF 2.0's Protect function, answers ISO 27001 Annex A controls, ticks a CIS safeguard, and addresses a row in your biggest customer's 400-question security questionnaire. One fact about your environment; six frameworks asking about it in six vocabularies.

The traditional answer is a static mapping document, and it fails in three predictable ways:

• It decays. Frameworks revise (see: Rev 3, CSF 2.0, ISO 27001:2022, CIS v8.1), and every revision quietly invalidates rows in every spreadsheet that references it.
• It's pairwise. Each framework pair is its own artifact. At the scale most organizations actually operate — four to six frameworks plus customer questionnaires — you're maintaining a small library of decaying spreadsheets.
• It maps requirements, not evidence. Knowing that 3.5.3 corresponds to ISO A.8.5 still leaves a human to find, re-justify, and re-package the same artifact for each assessment. The crosswalk tells you where the work is; it doesn't do the work.

What it looks like when evidence maps itself

PRISM inverts the model. Evidence — the documents, configurations, and artifacts you upload — is analyzed once and mapped against all 34 frameworks the platform maintains, across 2,623 requirements, simultaneously: CMMC and 800-171 alongside HIPAA, ISO 27001, SOC 2, CIS v8.1, CSF 2.0, and the rest. Not just the frameworks you've turned on: all of them, whether you asked or not. The crosswalk stops being a document anyone maintains and becomes a property of the evidence itself.

That design choice sounds like overkill until the day it isn't — which, in our experience, arrives on roughly three schedules:

• The customer asks. An enterprise prospect demands SOC 2-style answers before signing, a hospital system sends a HIPAA security questionnaire, a prime asks for your CSF posture. The answer already exists, because the evidence you assembled for whatever framework brought you in was mapped to the others the day you uploaded it.
• The regulator moves. When the DoD transitions CMMC to Rev 3, when HHS updates the HIPAA Security Rule, when a new state privacy law lands in your footprint: organizations with self-mapping evidence get a remapped posture; organizations with spreadsheets get a project.
• The strategy shifts. Entering healthcare, chasing enterprise deals that demand ISO 27001, deciding to bid on defense work, or facing a cyber insurance review stops being “start a new compliance program” and becomes “open a view that already exists.”

And because no two organizations answer only to published standards, PRISM also accepts custom frameworks: upload your prime's flow-down requirements, an internal control baseline, a state regulation, or that 400-question customer questionnaire, and it joins the same machinery — your existing evidence pool maps against it like it was a built-in standard. The same human-in-the-loop rule applies throughout: the AI proposes every mapping, a person approves it. (That review discipline is the same one behind the 18-hour Level 2 evidence engagement — speed from the AI, defensibility from the human.)